The Eclipse ThreadX GUIX binary resource loader reads a map_id value directly from a theme file without performing any bounds checking, causing a heap overflow of up to roughly 256 KB beyond the end of the internal pixelmap table. The overflowed buffer is allocated by GUIX itself through the its own memory allocator, so the write corrupts the GUIX arena rather than an external buffer. The CVE description makes no claim of arbitrary code execution; the impact is limited to memory corruption and potential program instability or crashes.

Eclipse Foundation Eclipse ThreadX – GUIX is affected when its default configuration has GX_BINARY_RESOURCE_SUPPORT enabled. The vulnerability is triggered by loading a crafted theme file and does not depend on user‑supplied buffer sizes.

With a CVSS score of 6.8 the vulnerability is classified as moderate risk. EPSS information is not available, and it is not listed in CISA KEV. Based on the description, the likely attack vector involves an attacker placing a malicious theme file in the directory that GUIX scans for resources. Because the public API gx_binres_theme_load() accepts no size parameter, no caller‑side checks can prevent the overflow. If the memory corruption is leveraged, it could lead to application crashes or, in the worst case, compromise of the embedded system if the corruption is exploitable further. Overall risk is moderate, and the flaw represents a practical target for exploitation on embedded devices that rely on Eclipse ThreadX GUIX.